Role in IT decision-making process:Align Business & IT GoalsCreate IT StrategyDetermine IT NeedsManage Vendor RelationshipsEvaluate/Specify Brands or VendorsOther RoleAuthorize PurchasesNot Involved

Work Phone:

Company:

Company Size:

Industry:

Street Address

City:

Zip/postal code

State/Province:

Country:

Occasionally, we send subscribers special offers from select partners. Would you like to receive these special partner offers via e-mail?YesNo

Your registration with Eweek will include the following free email newsletter(s):News & Views

By submitting your wireless number, you agree that eWEEK, its related properties, and vendor partners providing content you view may contact you using contact center technology. Your consent is not required to view content or use site features.

By clicking on the "Register" button below, I agree that I have carefully read the Terms of Service and the Privacy Policy and I agree to be legally bound by all such terms.

Another Phishing Hole Found in Google

Google says it has fixed one flaw in its site that allows cyber-criminals to launch phishing attacks using Google's familiar interface. But another hole still awaits a patch.

Google Inc. said on Thursday it fixed a flaw in its site that could allow outsiders to launch phishing attacks based on Googles familiar interface, and is working on a second fix for another similar vulnerability.

The flaw, which was discovered and posted to Symantec Corp.s Bugtraq security site on Tuesday. The bulletin demonstrated the ability of hackers using JavaScript to modify and enter their own content within Googles site in order to obtain personal information, including credit card numbers.

"Its not going to trick people going to Google.com, but if you can get someone to open your site, which looks like Googles site, its really quite clever," said Paul Mutton, an Internet services developer for Netcraft Ltd., a security and analyst firm based in Bath, England. "The user sees a URL address that starts with Google, and appears to be a Google Web site. Because its their domain, people wouldnt question what theyre seeing."

In addition, hackers could also use the flaw to monitor the searches individuals make from both the simulated Google search as well as the new Google Desktop, which was announced last week. Because Desktop searches personal computers, the security breech could be considered more serious.

Jim Ley said he originally discovered the scripting vulnerability more than two years ago, and warned on his site that he isnt convinced Googles initial fix goes far enough in preventing other attacks.

"This may mean there are remaining vectors to attack, either with different script methods, or by playing with charsets [character sets] that bypass the filtering," he said.

Netcraft researchers also informed Google on Wednesday of a similar, "more serious phishing vulnerability which would allow an attacker to inject their own content using the Google Web site."

For its part, Google said it fixed the initial vulnerability on Wednesday and all Google.com users were protected. But the company was alerted of the other flaw and is currently addressing that issue.

"The [original] vulnerability we were made aware of has been fixed," said a Google spokesman. "There was a second one that we are now working on and will be fixed shortly."

Google did not provide an exact time frame, but according to Netcrafts Mutton, Google expected to have the second flaw fixed by Friday.

/zimages/6/28571.gifCheck out eWEEK.coms Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers Weblog.